Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of… (CVE-2026-78592)

This vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in Kibana. A low-privileged user who can create tags can trigger a subsequent administrative action in the tag management interface to operate on unintended targets via path traversal. This can lead to unauthorized deletion of privileged resources, including administrative accounts and organizational assets. Successful exploitation requires an administrator to interact with the vulnerable interface, making it a chained attack scenario.

The vulnerability can cause high impact on integrity and availability by enabling deletion of privileged resources such as administrative accounts and organizational assets. Confidentiality is not impacted. Exploitation requires both a low-privileged user and an administrator's interaction, limiting the attack vector but still posing a significant risk to system stability and administration.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict tag creation privileges to trusted users and limit administrator interactions with the tag management interface to reduce risk.